Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Sep 2015 21:02:50 +0200
From: Florian Weimer <>
Cc: ISC Security Officer <>
Subject: Re: Two new vulnerabilities in BIND: CVE-2015-5722 and
 CVE-2015-5986 are now public

On 09/02/2015 10:52 PM, ISC Security Officer wrote:
> Please be advised that ISC publicly announced two critical
> vulnerabilities in BIND:
> + CVE-2015-5722 is a denial-of-service vector which can be
>   exploited remotely against a BIND server that is performing
>   validation on DNSSEC-signed records. All versions of BIND since
>   9.0.0 are vulnerable.

Your patch had quite good obfuscation, and it took me a while to see
where the actual fix was.  Was this deliberate?

But anyway, we can confirm it's exploitable over the network.  Nice
analysis, I would not have immediately seen that if I only had Hanno's

For validating recursors, it's actually quite a bit worse than
CVE-2015-5477 because CVE-2015-5722 does not require a completely
crafted query, just an attacker-controlled QNAME (which can be in the or tree) is sufficient.  So attacks could be
reflected through basically anything.

> + CVE-2015-5986 is a denial-of-service vector which can be used
>   against a BIND server that is performing recursion and (under
>   limited conditions) an authoritative-only nameserver.
>   Versions of BIND since 9.9.7 and 9.10.2 are vulnerable.

This can't be reflected as easily, only through applications that use
the affected record type.

Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.